EUVD-2026-107360
GHSA-pq5q-cxp8-rqcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged shell on Expressway
-
ExploitPlant or predict insecure temp file (CWE-377)
-
ExecutionPrivileged process or operator consumes file (UI:R)
-
ImpactTamper data and disrupt service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Secure temp file creation
|
| Exploitation Conditions | Exploitation requires the attacker to already have local, low-privileged access to the Cisco Expressway Series appliance (AV:L, PR:L) and depends on user interaction (UI:R) - typically a higher-privileged process or operator acting on an attacker-controlled temporary file. The root cause is insecure temporary file handling (CWE-377) in the Expressway Series software, so a predictable path, weak file permissions, or a TOCTOU window is the enabling condition. Limiting factors that reduce real-world risk: no remote/network vector, a valid local account is needed, interaction by another user/process is required, and there is no confidentiality impact (C:N) - only data tampering and service disruption. |
| Impact | This is a moderate-severity, locally-exploitable integrity/availability flaw rather than a top-priority remote threat. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H, score 6.6) establishes that exploitation requires LOCAL access, LOW-but-existing privileges on the appliance, AND user interaction - three independent barriers that sharply reduce real-world exploitability compared to a network-facing bug. No EPSS score, CISA KEV listing, or POC was supplied; per the input this means no public exploit identified at time of analysis, and the issue was internally discovered during a Cisco proactive security review rather than found through observed attacks, further lowering urgency. Signal conflict to flag: the input Tag labels this 'Information Disclosure,' but the CVSS vector explicitly sets C:N (no confidentiality impact) while rating I:H and A:H - the tag appears mislabeled and the true impact is data tampering and denial of service, not disclosure; defenders should prioritize this as an integrity/availability risk. There is no SSVC decision data in the input. Net: a legitimate issue to patch during normal maintenance cycles, not an emergency, because local privileged access is already a significant precondition. |
| Exploit ScenarioDerived | A low-privileged local user on a Cisco Expressway appliance abuses the insecure temporary-file handling (CWE-377) - for example a predictable path or weak permissions - so that when a higher-privileged process or operator interacts with that temp file, the attacker's planted content is consumed. This lets the attacker tamper with data (I:H) or disrupt the service (A:H). No public exploit code was identified at time of analysis, and user interaction plus local low-privileged access are both required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data and disrupt services when another user or process interacts with an attacker-influenced temporary file (CVSS 6.6; AV:L/PR:L/UI:R, C:N/I:H/A:H). The flaw is tracked as CWE-377 and affects the Cisco Telepresence Video Communication Server (VCS) Expressway product line; the available CPE data does not identify a specific version range. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
RemediationAI
Patch status is 'Patch available per vendor advisory': apply the fixed Cisco Expressway Series hardening release documented in Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs); the exact fix version is not specified in the provided input, so verify the release matching your deployed train in the advisory. Until the fixed release is applied, restrict local login and shell access to trusted administrators, enforce least privilege to reduce the PR:L prerequisite, and monitor temporary directories for unexpected file creation, permission changes, or process interactions; these are compensating/detective measures with operational overhead and do not fully remove the TOCTOU risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-377, insecure temporary file handling. In appliance software, predictable temporary filenames, permissive file permissions, or a race window between file creation and use (TOCTOU) can let a local user substitute or modify files processed by a more privileged service or operator. The CVSS vector confirms local access (AV:L), low privileges (PR:L), and user interaction (UI:R), with high integrity and availability impact but no confidentiality impact (C:N). Cisco states these were found during an internal security review and fixed in hardening releases; the CPE entry maps to Cisco Telepresence Video Communication Server (VCS) Expressway.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Insecure temp-file abuse needs local access and an existing low-privileged account (AV:L, PR:L) plus a privileged party acting on the file (UI:R); impact is tampering and DoS (I:H/A:H), no disclosure (C:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76497 are related to issues concerning insecure temporary files that are grouped under the Common Weakness Enumeration (CWE) Base CWE-377.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB